01/13/2021, 11:04 PM
is thre a way to run a single query against yara table with multiple sigfile's?
Mike Myers

Mike Myers

01/14/2021, 12:20 AM
Yes, that should be possible
Faraz Jafri

Faraz Jafri

01/14/2021, 11:31 AM
Have you tried using sig_group instead of sigfile? You can add multiple files collectively in a group and run a query with that sig_group. Though a group has to be defined in osquery.conf file.